Add marketplace 2.0 api client by valituguran · Pull Request #18 · opendevstack/ods-api-service

valituguran · 2026-04-14T13:52:50Z

Add Marketplace 2.0 client with config.

github-actions · 2026-04-14T13:59:33Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

github-actions · 2026-04-14T14:06:03Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

github-actions · 2026-04-14T14:22:07Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

github-actions · 2026-04-14T14:46:34Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…sage # Conflicts: # api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/controller/ComponentsResponseFactory.java # api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/controller/ProjectComponentsController.java # api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/facade/ComponentsFacade.java # api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/mapper/MarketplaceMapper.java # api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/controller/ProjectComponentsControllerTest.java # api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/facade/ComponentsFacadeTest.java # api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/util/TestObjectsBuilder.java # external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/model/ProjectComponent.java # external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/service/impl/MarketplaceServiceMockImpl.java

github-actions · 2026-04-21T11:06:57Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…ate components and added mandatory parameters to the marketplace 2.0 provision component call

github-actions · 2026-04-22T12:49:22Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…ent by project key and component ID

github-actions · 2026-04-27T13:37:52Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

github-actions · 2026-04-29T12:29:09Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

#20) … Marketplace API client with bearer token support --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…tFoundException

github-actions · 2026-04-29T13:59:11Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…ad requests

github-actions · 2026-04-29T14:29:02Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…ds from MarketplaceInstanceConfig and MarketplaceServiceImpl

github-actions · 2026-04-29T16:08:04Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…nts-api-usage' into feature/real-marketplace-components-api-usage

github-actions · 2026-04-29T19:41:39Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

Copilot

Pull request overview

This PR introduces a Marketplace 2.0 external-service client (OpenAPI-generated RestTemplate client + multi-instance configuration) and adds a shared core-security module for JWT utilities and OBO token exchange, while adapting the project-component v0 API layer to use the new Marketplace client types.

Changes:

Add Marketplace 2.0 client factory/config + service implementation using OpenAPI-generated clients.
Add core-security module with JwtUtils and OboTokenService, and switch api-project to use it.
Update project-component v0 facade/controller/mapper and tests to use Marketplace 2.0 models and new exception handling paths.

Reviewed changes

Copilot reviewed 49 out of 50 changed files in this pull request and generated 19 comments.

Show a summary per file

File	Description
persistence/src/main/java/org/opendevstack/apiservice/persistence/repository/AuthorizationPolicyJpaRepository.java	Treat “global” policies as `clientId IS NULL` or blank via custom JPQL query.
persistence/src/main/java/org/opendevstack/apiservice/persistence/dao/PolicyDaoImpl.java	Switch to new repository method for “global” policy lookup.
external-service-marketplace/src/test/java/org/opendevstack/apiservice/externalservice/marketplace/service/MarketplaceServiceImplTest.java	Unit tests for new MarketplaceServiceImpl behavior.
external-service-marketplace/src/test/java/org/opendevstack/apiservice/externalservice/marketplace/service/CatalogItemOperationsTest.java	Tests for catalog item id utility.
external-service-marketplace/src/test/java/org/opendevstack/apiservice/externalservice/marketplace/client/MarketplaceApiClientFactoryTest.java	Tests for instance resolution / factory behavior.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/service/impl/MarketplaceServiceMockImpl.java	Removes old mock implementation.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/service/impl/MarketplaceServiceImpl.java	Adds Marketplace 2.0 service implementation (OBO-authenticated calls, provision/delete/register, etc.).
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/service/MarketplaceService.java	Updates MarketplaceService contract to Marketplace 2.0 models and multi-instance support.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/service/CatalogItemOperations.java	Adds helper for catalog item id encoding/decoding/combining.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/model/CreateComponentParameter.java	Removes legacy create-component parameter model.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/exception/MarketplaceException.java	Adds checked exception type for marketplace integration.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/config/MarketplaceServiceConfig.java	Adds configuration properties root for marketplace instances + default instance.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/config/MarketplaceInstanceConfig.java	Defines per-instance properties (base URLs, timeouts, OBO scope, SSL trust, catalog item id).
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/client/MarketplaceApiClientFactory.java	Adds factory to build configured RestTemplates/clients per instance.
external-service-marketplace/src/main/java/org/opendevstack/apiservice/externalservice/marketplace/client/MarketplaceApiClient.java	Adds wrapper around generated ApiClient + bearer auth setup.
external-service-marketplace/pom.xml	Adds OpenAPI generator plugin, dependencies, and core-security dependency.
external-service-marketplace/openapi/openapi-component_provisioner-v1.0.0.yaml	Adds provisioner OpenAPI spec for client generation.
external-service-marketplace/openapi/openapi-component_catalog-v1.0.0.yaml	Adds catalog OpenAPI spec for client generation.
external-service-marketplace/.openapi-generator-ignore	Adds generator ignore patterns.
core-security/src/test/java/org/opendevstack/apiservice/core/security/obo/OboTokenServiceTest.java	Adds tests for OBO token exchange service.
core-security/src/test/java/org/opendevstack/apiservice/core/security/jwt/JwtUtilsTest.java	Adds tests for JWT helper utilities.
core-security/src/main/java/org/opendevstack/apiservice/core/security/obo/OboTokenService.java	Adds OBO token exchange implementation.
core-security/src/main/java/org/opendevstack/apiservice/core/security/obo/OboTokenResponse.java	Adds DTO for token endpoint response mapping.
core-security/src/main/java/org/opendevstack/apiservice/core/security/obo/OboTokenProperties.java	Adds configuration properties for token exchange (url/id/secret).
core-security/src/main/java/org/opendevstack/apiservice/core/security/obo/OboTokenException.java	Adds runtime exception for OBO exchange failures.
core-security/src/main/java/org/opendevstack/apiservice/core/security/jwt/JwtUtils.java	Adds shared JWT helper utilities used by other modules.
application.yaml	Adds OBO config and marketplace instance config in application config.
api-project/src/main/java/org/opendevstack/apiservice/project/util/SecurityUtils.java	Removes project-local SecurityUtils in favor of shared JwtUtils.
api-project/src/main/java/org/opendevstack/apiservice/project/controller/ProjectController.java	Switches client-id extraction to shared JwtUtils.
api-project/pom.xml	Adds dependency on core-security.
api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/util/TestObjectsBuilder.java	Updates test object builders to Marketplace 2.0 models and adds CatalogItem builder.
api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/facade/ComponentsFacadeTest.java	Updates facade tests for provision flow and marketplace 2.0 DTOs.
api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/controller/advice/ProjectComponentsExceptionHandlerTest.java	Adds tests for new conflict mapping (already-exists).
api-project-component-v0/src/test/java/org/opendevstack/apiservice/project/controller/ProjectComponentsControllerTest.java	Updates controller tests for new provision semantics and component-id type change.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/mapper/StatusMap.java	Adds mapping from marketplace statuses to legacy v0 statuses.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/mapper/MarketplaceMapper.java	Reworks mapping to use Marketplace 2.0 OpenAPI models and provision parameters.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/facade/ComponentsFacade.java	Reworks facade to provision via marketplace 2.0 client and fetch catalog item metadata.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/exception/ComponentRetrievalException.java	Adds retrieval exception wrapper.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/exception/ComponentNotFoundException.java	Adds overload with cause.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/exception/ComponentCreationException.java	Adds overload with cause.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/exception/ComponentBadRequestException.java	Adds bad-request exception type.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/exception/ComponentAlreadyExistsException.java	Adds already-exists exception type.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/exception/CatalogItemNotFoundException.java	Adds catalog-item-not-found exception type.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/controller/advice/ProjectComponentsExceptionHandler.java	Adds handlers for new exception types and retrieval failures.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/controller/ProjectComponentsController.java	Switches create to “provision” and changes componentId type to string.
api-project-component-v0/src/main/java/org/opendevstack/apiservice/project/controller/ComponentsResponseFactory.java	Adds response helpers for conflict and unprocessable entity.
api-project-component-v0/pom.xml	Adds dependency on core-security.
api-project-component-v0/openapi/api-project-component-v0.yaml	Removes UUID format constraint for componentId parameter.
Makefile	Extends `clean` target to remove targets/generated models and local Maven cache.
.gitignore	Ignores generated Marketplace OpenAPI sources directory.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-30T13:57:17Z

+    void testGetProjectComponent_NullInstanceName_UsesDefaultClient() throws MarketplaceException {
+        // Passing null explicitly as instanceName should resolve via getDefaultInstance -> getAuthenticatedClient
+        String projectKey = "PROJ";
+        String componentId = "test-component";
+        MarketplaceInstanceConfig instanceConfig = new MarketplaceInstanceConfig();


This test implies null instanceName should be accepted, but MarketplaceApiClientFactory#getClient(String) is defined to throw on null/blank. Either make MarketplaceServiceImpl resolve null/blank to the default instance, or update the test to align with the factory contract.

Copilot · 2026-04-30T13:57:21Z

+            SSLContext context = SSLContext.getInstance("TLS");
+            context.init(null, trustAllCerttificates, new java.security.SecureRandom());
+
+            HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
+            // Intentionally disabling hostname verification for development environments
+            HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);
+


The implementation of configureTrustAllCertificates() mutates global HttpsURLConnection defaults (socket factory + hostname verifier). Even if guarded by config, this leaks outside Marketplace and can unintentionally disable TLS verification for other outbound calls. Rework this to use a per-RestTemplate SSLContext / request factory instead of JVM-global defaults.

Copilot · 2026-04-30T13:57:21Z

+        <dependency>
+            <groupId>com.google.code.findbugs</groupId>
+            <artifactId>jsr305</artifactId>
+            <version>3.0.2</version>
+            <scope>compile</scope>
+        </dependency>


There is a second jsr305 dependency declaration later in this POM with a different scope. Remove the duplicate and standardize on one scope to avoid classpath surprises.

Copilot · 2026-04-30T13:57:22Z

+        return new String(encodeId(
+                new String(decodeId(component.getCatalogItemId())) + new String(decodeId(component.getCatalogItemRef()))));
+    }


buildCatalogItemId converts decoded Base64 bytes to String without specifying a charset. Specify the charset explicitly when constructing strings from bytes to avoid platform-dependent behavior.

…b.com:opendevstack/ods-api-service into feature/real-marketplace-components-api-usage

github-actions · 2026-04-30T15:04:11Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-04-30T18:31:29Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

github-actions · 2026-04-30T18:35:18Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

…on handling in Marketplace API client

github-actions · 2026-04-30T18:49:06Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

jorge-romero

Please review the comments, there are things that should affect some use cases.

jorge-romero · 2026-05-04T14:21:36Z

+        provisioner-actions-base-url: ${MARKETPLACE_PROVISIONER_ACTIONS_BASE_URL:}
+        obo-scope: ${MARKETPLACE_OBO_SCOPE:}
+        trust-all-certificates: ${MARKETPLACE_TRUST_ALL_CERTS:false}
+        catalog-item-id: ${MARKETPLACE_CATALOG_ITEM_ID:}


this last line should not be needed

jorge-romero · 2026-05-04T14:53:07Z

+            log.warn("No Marketplace instances configured – reporting unhealthy");
+            return false;
+        }
+        return true;


Nothing is check, only if it is configured

jorge-romero · 2026-05-04T14:54:35Z

+     * Creates a {@link MarketplaceApiClient} authenticated with an OBO token
+     * obtained from the current request's JWT.
+     */
+    private MarketplaceApiClient getAuthenticatedClient(String instanceName) throws MarketplaceException {


Maybe you need 2 methods, for OBO and CC
or in the factory.

…pl tests

github-actions · 2026-05-05T11:24:01Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

… API

sonarqubecloud · 2026-05-05T15:56:47Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-05-05T16:04:49Z

📊 Static Analysis Summary

🔍 Code Quality Checks

✅ JaCoCo coverage report generated

📦 Download detailed reports from the workflow artifacts.

Add marketplace api client.

636cc1c

Add marketplace api client.

27682ee

Remove unused var.

2c9e956

Fix sonarqube complaints.

6ee3a28

zxBCN Valeriu_Tuguran,Constantin (IT EDP) EXTERNAL added 3 commits April 21, 2026 10:48

Add delete component functionality - not finished.

cf25bfb

Add delete component functionality - not finished.

0e72bc9

Implement component existence check and exception handling for duplic…

4138b18

…ate components and added mandatory parameters to the marketplace 2.0 provision component call

Add API endpoint to retrieve extended information of a project compon…

911780e

…ent by project key and component ID

Update getComponent to call the new endpoint.

3d708a6

angelmp01 and others added 3 commits April 29, 2026 15:20

Implement On-Behalf-Of (OBO) token exchange functionality and enhance… (

05fa84f

#20) … Marketplace API client with bearer token support --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Fix github comments.

db955b7

Refactor exception handling in getProjectComponent to use ComponentNo…

05a1abf

…tFoundException

Add ComponentBadRequestException and enhance exception handling for b…

3a7c372

…ad requests

Remove unused workflow, odsNamespace, and quickstarterRepository fiel…

2febcc7

…ds from MarketplaceInstanceConfig and MarketplaceServiceImpl

zxBCN Valeriu_Tuguran,Constantin (IT EDP) EXTERNAL added 2 commits April 29, 2026 21:33

Fix test.

5dff575

Merge remote-tracking branch 'origin/feature/real-marketplace-compone…

d899671

…nts-api-usage' into feature/real-marketplace-components-api-usage

jorge-romero requested a review from Copilot April 30, 2026 13:45

Copilot started reviewing on behalf of jorge-romero April 30, 2026 13:46 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

angelmp01 added 2 commits April 30, 2026 16:56

Add catalog item resolution and enhance component provisioning logic

f93621f

Merge branch 'feature/real-marketplace-components-api-usage' of githu…

fb1f6ab

…b.com:opendevstack/ods-api-service into feature/real-marketplace-components-api-usage

angelmp01 and others added 2 commits April 30, 2026 20:24

Apply suggestion from @Copilot

68b9053

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Apply suggestions from code review

ea8b1d2

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Enhance encoding and decoding of catalog item IDs and improve excepti…

512bf76

…on handling in Marketplace API client

jorge-romero requested changes May 4, 2026

View reviewed changes

Add unit tests for MarketplaceMapper and enhance MarketplaceServiceIm…

89f5e5d

…pl tests

Add health check endpoints for Catalog and Provisioner in Marketplace…

ba16253

… API

jorge-romero approved these changes May 5, 2026

View reviewed changes

angelmp01 merged commit 44befbb into develop May 5, 2026
4 checks passed

jorge-romero deleted the feature/real-marketplace-components-api-usage branch May 19, 2026 07:04

Conversation

valituguran commented Apr 14, 2026

Uh oh!

github-actions Bot commented Apr 14, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 14, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 14, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 14, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 21, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 22, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 27, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 29, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 29, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 29, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 29, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

github-actions Bot commented Apr 29, 2026

📊 Static Analysis Summary

🔍 Code Quality Checks

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

angelmp01 May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

angelmp01 May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

angelmp01 May 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026